CGA-5j94-hq8c-4597

Published

Last updated

https://images.chainguard.dev/security/CGA-5j94-hq8c-4597

Package

pulumi

Latest Update

Fixed

Fixed Version

3.142.0-r1

Aliases

CVE-2024-36621
GHSA-2mj3-vfvx-fc43

Severity

6.5

Medium

CVSS V3

Summary

Moby Race Condition vulnerability

Description

moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-36621
https://github.com/advisories/GHSA-2mj3-vfvx-fc43
https://github.com/moby/moby/commit/37545cc644344dcb576cba67eb7b6f51a463d31e
https://gist.github.com/1047524396/5d44459edab5fafcdf86b43909b81135
https://github.com/moby/moby
https://github.com/moby/moby/blob/v25.0.5/builder/builder-next/adapters/snapshot/layer.go#L24

Updates

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

CGA-5j94-hq8c-4597

Severity

Summary

Description

References

Updates

Product

Why Chainguard

Customers

Company

Resources